Technical impact
InvoicePlane allows the administrator to include the value of the tax_rate_decimal_places setting directly in an ALTER TABLE statement without enforcing integer validation. A malicious value can inject additional DDL clauses that remove or alter required columns, corrupting the database schema and disrupting financial data handling. The consequence is loss of data integrity and likely downtime for the application.
Affected Systems
The vulnerability affects InvoicePlane versions prior to 1.7.2. Users running any release before the 1.7.2 point release are susceptible. The issue originates in the Settings::index() routine, which is used by the administrative interface to manage tax rate precision settings.
Risk and Exploitability
The CVSS score of 7.2 indicates a high impact vulnerability. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from publicly available data. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to gain administrative access or modify the tax_rate_decimal_places configuration, which is typically restricted to staff with elevated privileges. Once injected, the schema changes can permanently alter the database, potentially allowing further exploitation or creating data loss. The lack of a publicly disclosed exploit means the exact attack path is not confirmed, but the presence of injection in a schema‑changing statement presents a significant risk to systems that rely on InvoicePlane for accounting.
